What is safe way to communicate java applet -> MySQL

Question

Im making a small java game which is running on webpages. Now Im trying to get my game to communicate with MySQL db and its now doing it via PHP.

So here is what happens:

1. There is basic login system which sets session when logged in (PHP).
2. When the java game is asking data from db it sends POST (URLConnection) to PHP page.
3. PHP page checks that session is set, if so it echos wanted info from db.
4. Java game plays with PHP page output.

Working and running like a dream!

Only thing Im worried is that I actually have to change and store more data into db via this same cycle. So if you have your session running you can basicly do nice HTML form and set better weapon for your character.

I tried to google basic ways to communicate with databases and the basic theory how servers work safely. No easy answers.

So shortly my question is,

What is the safe and right way to communicate (read and write) between java app and database?

And for future do the same with android apps etc. Im glad if you just give me a kick to right direction.

Thanking you!

Answer 1

There is none. If there is any way a client can issue arbitrary SQL queries directly to the server from the outside, then there's virtually no protection that prevents anyone from doing anything with the database they want, include SELECT * FROM users and DROP TABLE users .

You always want an API between the outside world and your server components which defines clearly allowed actions and blocks anything else. Allowing arbitrary SQL queries is basically an API allowing unrestricted access to everything in the database, which is usually too broad.

The way you usually do this is to define a number of actions that a client can do and expose them via an API, say a REST API. The Java client talks to this API, whatever happens behind the scenes on the server is irrelevant. It's not about "talking to a database", it's about doing certain things on the server . And the number of those things is and should be limited.

Answer 2

Take a look at this articles...

What Applets Can and Cannot Do

Security Issues with the Applet